JNCIE-DC cheat sheet

Spine-leaf (Clos) topology: every leaf connects to every spine; server-to-server path is always leaf-spine-leaf with a predictable, equal hop count and uniform latency.

Oversubscription ratio = total downlink (host-facing) bandwidth / total uplink (spine-facing) bandwidth per leaf; a 1:1 design removes congestion points but raises spine port cost.

ECMP path count from a leaf = number of spines; keep per-flow hashing entropy high (L3/L4 tuple) so flows spread evenly across all spine links.

Recommended IP fabric uses /31 or /127 point-to-point links between leaf and spine, loopback /32 per device for BGP router-id and VTEP source.

Underlay routing options: eBGP with unique private ASN per leaf and one common spine ASN, or OSPF/IS-IS; eBGP scales better and gives per-link failure isolation.

VXLAN VNI space is 24 bits (16,777,216); VLAN ID space is 12 bits (4,096), so VNI-to-VLAN mapping is many-to-one at the edge.

MTU planning: underlay must carry outer IP + UDP + VXLAN (50 bytes) plus inner frame; set fabric MTU to at least 9000 or 1600+ consistently on all links.

Design rule: place Layer 2 gateway (IRB) as high as possible (spine or border) to reduce ARP/ND scale on leaves and simplify DCI.

EVPN route types: Type 1 Ethernet Auto-Discovery, Type 2 MAC/IP advertisement, Type 3 Inclusive Multicast Ethernet Tag (IMET), Type 4 Ethernet Segment, Type 5 IP Prefix.

Type 2 route carries MAC, optional IP, VNI, and Ethernet tag; MAC-only routes suppress ARP flooding, MAC/IP routes enable ARP/ND suppression and symmetric IRB.

Type 3 IMET route is required for BUM traffic: each VTEP advertises its VTEP IP per VNI; remote VTEPs build the ingress replication list from these routes.

Symmetric IRB uses two VNIs (L2 VNI for bridging, L3 VNI for routing) and a shared anycast gateway MAC; asymmetric IRB routes into the L2 VNI without an L3 VNI.

Anycast gateway: same IP and same virtual MAC configured on all leaves for a subnet; requires no duplicate IP detection suppression and consistent VNI/VLAN mapping.

Route-target policy: use auto-derived RTs (AS:VNI) or explicit import/export RTs; mismatched RTs are the most common cause of missing Type 2/3 routes.

EVPN multihoming (ESI) replaces MC-LAG: Type 1 per-ESI and Type 4 routes elect a designated forwarder; all-active mode gives per-flow load sharing across peers.

Verify with: show evpn database, show ethernet-switching table evpn, show bgp evpn route-type {2,3,5}, show vxlan tunnel endpoints.

Underlay carries only loopback-to-loopback IP reachability and VTEP reachability; overlay (VXLAN) carries tenant MAC/IP and is independent of underlay IGP choice.

VTEP source is the loopback IP; the outer header is IP/UDP (dst port 4789)/VXLAN; the inner frame retains tenant VLAN tag information encoded in the VNI.

BUM handling: ingress replication (head-end) uses the Type 3 IMET list; multicast underlay uses a group per VNI with PIM-SM in the underlay.

ARP/ND suppression: leaf proxies ARP replies from the EVPN database (Type 2 MAC/IP routes) so broadcast ARP does not flood the fabric.

Distributed anycast gateway enables optimal east-west routing: first hop is the local leaf, so traffic never trombones to a central gateway.

Overlay routing with EVPN Type 5 advertises IP prefixes (with optional VNI/RT) so inter-VNI routing can occur without a per-VNI L2 stretch.

Underlay BGP best practice: advertise only loopbacks and p2p links, use bfd for fast failure detection, and set maximum-paths for ECMP.

Troubleshooting order: underlay loopback ping, BGP EVPN session state, Type 3 IMET presence, Type 2 MAC learning, then data-plane VXLAN counters.

DCI options: L2 stretch (VXLAN over DCI or OTV/VPLS), L3 interconnect with EVPN Type 5, or a dedicated DCI gateway pair; L3 DCI avoids spanning-tree and broadcast domain extension.

VXLAN over DCI requires VTEP reachability across sites; use a dedicated DCI VNI or map inter-site traffic to a border leaf pair acting as DCI gateways.

EVPN Type 5 IP prefix routes across sites enable inter-site routing with route-target import/export control per tenant, avoiding MAC flooding over the WAN.

Anycast gateway across sites: same gateway IP/MAC in both DCs gives seamless VM mobility, but requires consistent VLAN/VNI mapping and ARP/ND sync or EVPN suppression.

Stretched L2 caveats: broadcast storms, unknown unicast flooding, and STP domain extension across sites; mitigate with EVPN suppression and storm control.

DCI latency and MTU: WAN path must support the 50-byte VXLAN overhead; verify DF-bit handling and fragmentation policy on the DCI edge.

Route leaking between sites: control with per-site RTs or a shared L3 VNI; avoid overlapping tenant IP space unless using VRFs with distinct RTs.

Failure domain: design DCI with redundant border leaf pairs and diverse WAN paths; test failover of the DCI gateway and Type 5 route withdrawal.

VRF per tenant isolates routing tables; each VRF maps to a unique L3 VNI and route-target so tenant prefixes never leak between VRFs.

VLAN-to-VNI mapping should be deterministic (e.g., VLAN 10 -> VNI 1010) to simplify operations and troubleshooting across the fabric.

Overlapping tenant IP space is supported by separate VRFs and L3 VNIs; the same subnet in two tenants must use different VNIs and RTs.

Route-target design: auto (AS:VNI) is simple; manual RTs allow hub-and-spoke or selective import (extranet) between VRFs.

Extranet/route leaking: import the remote VRF's RT into the local VRF and vice versa; verify with show route table and EVPN Type 5 routes.

Tenant scale limits: per-VTEP MAC table, ARP/ND table, and VNI count are hardware-bound; check platform limits for MACs per VNI and VNIs per system.

Multicast per tenant: each VNI maps to a multicast group in the underlay; PIM-SM rendezvous point and group range must be planned per fabric.

Security boundary: tenant isolation is enforced by VRF/VNI separation; apply stateless filters or stateful firewalls between VRFs for policy enforcement.

Junos automation interfaces: NETCONF over SSH (port 830), REST API over HTTPS, gRPC/gNMI (Junos Telemetry Interface), and Junos PyEZ for Python scripting.

Configuration workflow: load merge/replace, commit check, commit confirmed for safe rollback if the session drops, then commit.

NETCONF operations: , (merge/replace/create/delete), , /; candidate datastore enables atomic changes.

Junos PyEZ: Device(host=..., user=..., password=...) then dev.open(); use Config() for load/commit and rpc for operational commands.

Ansible for Junos uses junos_config, junos_command, junos_facts modules; connection: netconf or network_cli with provider settings.

Telemetry: JTI pushes streaming data (gRPC/OpenConfig) at configured intervals; useful for fabric-wide counter and interface monitoring.

Zero-touch provisioning: DHCP option 82/66/67 delivers image and config; use a bootstrap config with a serial-number-based template.

Idempotency and version control: store intended config in Git, render with templates (Jinja2), and validate with commit check before deployment.

EVPN multihoming ESI: all-active mode forwards per-flow across all peer links; designated forwarder election (Type 4) prevents duplicate BUM delivery.

BFD timers: micro-BFD on LAG members and single-hop BFD on p2p links detect failures in milliseconds; tune multiplier to avoid false positives.

GR/NSR: graceful restart preserves forwarding during control-plane restart; NSR keeps routing state on the backup RE without protocol flap.

Commit confirmed: commit confirmed 5 auto-rolls back in 5 minutes unless confirmed; essential for remote changes that could cut management access.

Troubleshooting EVPN: check BGP EVPN session (show bgp summary), Type 2/3 route presence, VNI state (show vxlan vni), and interface up/up.

MAC learning issues: verify the local MAC is in the EVPN database and advertised; check RT import/export and VNI mapping on both ends.

Loop prevention: underlay uses TTL/split-horizon; overlay uses split-horizon (no forwarding back out the same VNI) and STP is not needed in the fabric.

Log and trace: show log messages, monitor traffic interface, and traceoptions for BGP/VXLAN; capture with monitor traffic matching vxlan port 4789.

Stateless filters (firewall filter family inet/ethernet-switching) apply at ingress/egress; stateful policy requires a services blade or firewall insertion.

Control-plane protection: apply loopback filters (family inet) to restrict SSH, NETCONF, and BGP to management/peer subnets; rate-limit ICMP and ARP.

Tenant isolation: VRF/VNI separation plus RT control prevents cross-tenant reachability; verify no unintended RT imports between VRFs.

MACsec (802.1AE) on leaf-spine links encrypts hop-by-hop; VXLAN itself does not encrypt, so use IPsec for WAN/DCI confidentiality.

DHCP snooping, dynamic ARP inspection, and IP source guard protect the access edge from spoofing; enable on host-facing leaf ports.

Storm control on host ports limits broadcast/multicast/unknown-unicast; pair with EVPN ARP suppression to reduce BUM scope.

Role-based access: Junos login classes and RADIUS/TACACS+ authentication; separate operational and configuration permissions.

Policy verification: show firewall, show configuration firewall family inet filter, and counter checks to confirm traffic is actually matching.